Intune SCEP Certificate Issues? Troubleshoot Device Enrollment Problems Here

Table of Contents

Simple Certificate Enrollment Protocol (SCEP) plays a vital role in modern device management, especially when integrated with Microsoft Intune. It enables the automated provisioning of certificates to devices, ensuring secure authentication and access to corporate resources. However, like any complex system, SCEP deployments can encounter issues. One common problem manifests as the 0x80094800 error code coupled with Event ID 31 in server logs. This error typically arises when devices fail to obtain certificates from the Network Device Enrollment Service (NDES) server, disrupting device enrollment and secure access.

This article delves into the intricacies of this specific error scenario, providing a comprehensive guide to understanding, diagnosing, and resolving the underlying causes. We will explore the symptoms, pinpoint the root cause related to certificate template configurations, and present a step-by-step solution to restore SCEP certificate enrollment functionality within your Intune environment. By understanding these troubleshooting steps, administrators can effectively manage their certificate infrastructure and maintain seamless device enrollment processes.

Symptoms¶

When devices are unable to obtain SCEP certificates from the NDES server, several indicators can point towards the 0x80094800 error and Event ID 31 issue. These symptoms are typically observed in two key locations: the Certificate Authority (CA) server and the NDES server itself. Examining the error logs in these locations is crucial for accurate diagnosis.

Certificate Authority (CA) - Failed Requests¶

Within the Certificate Authority’s management console, specifically under the “Failed Requests” section, you will likely find entries related to the problematic certificate requests. These failed requests will display specific error codes and disposition messages that are indicative of the 0x80094800 error. The key indicators in the CA’s Failed Requests are:

Request Status Code:

“The requested certificate template is not supported by this CA. 0x80094800 (-2146875392 CERTSRV_E_UNSUPPORTED_CERT_TYPE)”

Request Disposition Message:

“The request was for a certificate template that is not supported by the Active Directory Certificate Services Policy: <Template name in the client request>“

These messages clearly indicate that the Certificate Authority is rejecting the certificate request because it deems the requested certificate template as unsupported. The error code 0x80094800, specifically CERTSRV_E_UNSUPPORTED_CERT_TYPE, reinforces this conclusion. This points towards a configuration mismatch or an issue with the certificate template itself within the CA’s policy. It’s important to note the specific template name mentioned in the “Request Disposition Message” as this will be critical in further investigation.

NDES Server - Application Log¶

The second crucial location to examine for symptoms is the Application log on the NDES server. Event ID 31 from the Microsoft-Windows-NetworkDeviceEnrollmentService source is a strong indicator of this SCEP certificate enrollment failure. The event details provide valuable information about the error encountered by the NDES service when attempting to submit the certificate request to the CA.

Log Name: Application

Source: Microsoft-Windows-NetworkDeviceEnrollmentService

Event ID: 31

Level: Error

User: CONTOSO\SVC_NDES

Computer: NDES1.contoso.com

Description:

The Network Device Enrollment Service cannot submit the certificate request (The requested certificate template is not supported by this CA.). 0x80004005

Event Xml:

<Event xmlns=”http://schemas.microsoft.com/win/2004/08/events/event”>

<EventData Name=”EVENT_MSCEP_FAIL_SUBMIT“>

<Data Name=”ErrorCode”>The requested certificate template is not supported by this CA.</Data>

<Data Name=”ErrorMessage”>0x80004005</Data>

</EventData>

</Event>

The Event ID 31 description, “The Network Device Enrollment Service cannot submit the certificate request (The requested certificate template is not supported by this CA.). 0x80004005”, directly mirrors the error observed in the CA’s Failed Requests. While the error code presented here is 0x80004005 (which is a generic error code often indicating “Unspecified error”), the crucial part of the message is the embedded explanation: “The requested certificate template is not supported by this CA.” This further confirms the issue lies with the certificate template configuration as perceived by the Certificate Authority.

The combination of these symptoms - the 0x80094800 error in CA Failed Requests and Event ID 31 on the NDES server - strongly points towards a problem related to the certificate template configuration between the NDES server and the Certificate Authority.

Understanding the Root Cause¶

The root cause of the 0x80094800 error and Event ID 31 in SCEP certificate enrollment failures often lies in a subtle but critical discrepancy in how certificate templates are referenced between the NDES server and the Certificate Authority. Specifically, this issue arises when the template name configured on the NDES server does not precisely match the template name recognized by the CA.

In many environments, administrators might use the template display name (also known as the “friendly name”) when configuring the NDES server. While the display name is user-friendly and easier to remember, the Certificate Authority internally identifies certificate templates by their template name (also known as the “CN” or Common Name). These two names, display name and template name, can be different.

Imagine a scenario where you have created a certificate template on your CA called “SCEP Enrollment Template” as its display name. However, during template creation, the actual template name (CN) might have been automatically assigned as something like “SCEPEnrollmentTemplate01” or a similar variation without spaces and with appended numbers.

When configuring the NDES server, if you mistakenly use the display name “SCEP Enrollment Template” in the NDES policy or configuration files, the NDES server will forward this display name in the certificate request to the CA. However, the CA is configured to recognize templates by their template name (e.g., “SCEPEnrollmentTemplate01”). Because the CA cannot find a template with the exact name “SCEP Enrollment Template,” it rejects the request, leading to the 0x80094800 error and Event ID 31.

Essentially, the CA is saying, “I don’t recognize a certificate template with the name you are requesting.” This mismatch in template naming is the fundamental reason for the failure. The solution, therefore, revolves around ensuring that the NDES server is configured to use the correct template name (CN) as understood by the Certificate Authority, rather than relying on the display name. In most cases, you need to use the actual template name and not the friendly name for the NDES configuration to correctly identify the certificate template on the CA.

Step-by-Step Solution¶

To resolve the 0x80094800 error and Event ID 31 and restore SCEP certificate enrollment functionality, you need to ensure that the NDES server is configured to use the correct certificate template name as recognized by the Certificate Authority. Follow these steps to rectify the template name mismatch:

1. Identify the Correct Certificate Template Name on the CA¶

The first step is to determine the accurate template name (CN) of the certificate template intended for SCEP enrollment on your Certificate Authority.

1. Open the Certification Authority Management Console: On your CA server, open Server Manager and then navigate to Tools > Certification Authority.
2. Locate your Certificate Template: In the Certification Authority console, expand your CA name. Then, navigate to “Certificate Templates.”
3. Find the SCEP Template: Locate the certificate template you are using for SCEP enrollment. This is likely the template specified in your Intune SCEP certificate profile.
4. View Template Properties: Right-click on the SCEP certificate template and select “Properties.”
5. Note the “Template name”: In the Template Properties window, go to the “General” tab. The “Template name” field displays the template name (CN) that the CA uses to identify this template. Carefully note down this exact template name. This is the value you need to use in your NDES configuration. Do not confuse this with the “Display name” which is also shown on the General tab.

2. Update NDES Configuration with the Correct Template Name¶

Now that you have identified the correct template name from the CA, you need to update the NDES server configuration to use this name. The NDES configuration for certificate templates is typically stored in the registry.

1. Open Registry Editor on the NDES Server: On your NDES server, open the Registry Editor (regedit.exe) as an administrator.
2. Navigate to the NDES Configuration Path: Navigate to the following registry path: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography\MSCEP.
3. Locate the Certificate Template Entries: Under the MSCEP key, you will find registry entries for the certificate templates configured for NDES. These are usually named EncryptionTemplate, GeneralPurposeTemplate, and SignatureTemplate. The specific template you need to modify depends on how you have configured your SCEP profiles in Intune and which template is failing. Often, for device enrollment scenarios, you will be focusing on the EncryptionTemplate and/or SignatureTemplate.
4. Modify the Template Name Value:
   • Double-click on the registry value corresponding to the template you need to correct (e.g., EncryptionTemplate).
   • In the “Value data” field, replace the existing template name with the accurate template name you noted down from the CA in Step 1. Ensure that you type the name exactly as it appears in the CA template properties, paying attention to case sensitivity and any special characters.
   • Click “OK” to save the changes.
   • Repeat this step for any other relevant template entries (e.g., SignatureTemplate) if necessary, ensuring each uses the correct template name from the CA.

3. Restart the NDES Service¶

After modifying the registry settings, you must restart the Network Device Enrollment Service for the changes to take effect.

1. Open Services Manager: On your NDES server, open the Services Manager (services.msc).
2. Locate the Network Device Enrollment Service: Find the service named “Network Device Enrollment Service.”
3. Restart the Service: Right-click on the “Network Device Enrollment Service” and select “Restart.”

4. Test SCEP Certificate Enrollment¶

Once the NDES service has restarted, test the SCEP certificate enrollment process to verify that the issue is resolved.

1. Trigger Device Enrollment: Initiate device enrollment from a test device, or force a policy refresh on an already enrolled device that is supposed to receive a SCEP certificate.
2. Monitor Device Status in Intune: Monitor the device status in the Intune admin center to see if the SCEP certificate profile is successfully applied.
3. Check CA Failed Requests: Re-examine the “Failed Requests” section in the Certification Authority management console. Ensure that there are no new failed requests with the 0x80094800 error related to SCEP enrollment.
4. Check NDES Server Application Log: Monitor the Application log on the NDES server for Event ID 31. Verify that Event ID 31 is no longer being logged related to certificate enrollment failures.

If the test is successful, devices should now be able to obtain SCEP certificates from the NDES server, and the 0x80094800 error and Event ID 31 should be resolved.

Best Practices for SCEP Certificate Management¶

To prevent recurrence of this and similar SCEP certificate enrollment issues, consider implementing these best practices for SCEP certificate management:

• Document Template Names Clearly: Maintain clear documentation of all certificate templates used for SCEP enrollment, explicitly noting down both the display name and the template name (CN). This documentation will be invaluable for troubleshooting and future configuration changes.
• Use Consistent Naming Conventions: Adopt a consistent naming convention for certificate templates. While display names can be user-friendly, strive to make template names (CNs) also reasonably descriptive and easy to identify, minimizing the chance of confusion.
• Regularly Review NDES Configuration: Periodically review the NDES server configuration, especially the registry settings related to certificate templates, to ensure they are correctly aligned with the CA’s certificate templates.
• Implement Monitoring: Set up monitoring for both the Certificate Authority and NDES servers to proactively detect certificate enrollment failures. Alerting on Event ID 31 and errors in CA Failed Requests can help identify issues quickly before they impact a large number of devices.
• Test Changes in a Test Environment: Before implementing any changes to certificate templates or NDES configurations in a production environment, thoroughly test them in a non-production test environment to identify and resolve any potential issues beforehand.
• Consider Automation: Explore automation tools and scripts for managing certificate templates and NDES configurations. Automation can reduce manual errors and ensure consistency across your certificate infrastructure.

By following these best practices, you can enhance the reliability and stability of your SCEP certificate enrollment infrastructure, minimizing troubleshooting efforts and ensuring smooth device enrollment and secure access for your users.

Conclusion¶

The 0x80094800 error and Event ID 31 during SCEP certificate enrollment are typically caused by a mismatch between the certificate template name configured on the NDES server and the actual template name recognized by the Certificate Authority. By accurately identifying the template name on the CA and updating the NDES server configuration accordingly, you can effectively resolve this issue and restore SCEP certificate enrollment functionality. Remember to restart the NDES service after making configuration changes and thoroughly test the solution. Proactive management and adherence to best practices are key to maintaining a healthy and reliable SCEP certificate infrastructure.

Do you have any experience with SCEP certificate enrollment issues in Intune? Share your troubleshooting tips or questions in the comments below!